You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by jl...@apache.org on 2024/05/20 09:03:41 UTC
(ofbiz-framework) branch release18.12 updated (35b4b89f28 -> cb8c65124b)
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a change to branch release18.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
from 35b4b89f28 Fixed: dateType parameter not existing in "renderDateTimeField" Macro (OFBIZ-13039)
new e72a4a9461 Fixed: Error in PayGradeForms.xml Line: 65 (OFBIZ-13062)
new d33ce31012 Improved: Prevent special encoded characters sequences in URLs (OFBIZ-13092)
new cb8c65124b Fixed: The non ASCII language in UiLabels.xml are not correctly handled during plugin creation (OFBIZ-13095)
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
applications/humanres/widget/forms/PayGradeForms.xml | 3 +--
framework/resources/templates/UiLabels.xml | 10 ++--------
framework/security/config/security.properties | 2 +-
.../java/org/apache/ofbiz/webapp/control/ControlFilter.java | 8 ++++++--
4 files changed, 10 insertions(+), 13 deletions(-)
(ofbiz-framework) 02/03: Improved: Prevent special encoded characters sequences in URLs (OFBIZ-13092)
Posted by jl...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch release18.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit d33ce31012c97056f6e755261905e0950c96489d
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Wed May 15 12:30:46 2024 +0200
Improved: Prevent special encoded characters sequences in URLs (OFBIZ-13092)
Better avoid special encoded characters sequences
Improves deniedWebShellTokens in security.properties
---
framework/security/config/security.properties | 2 +-
.../main/java/org/apache/ofbiz/webapp/control/ControlFilter.java | 8 ++++++--
2 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/framework/security/config/security.properties b/framework/security/config/security.properties
index 1dfb43cdd9..f7dbd25c12 100644
--- a/framework/security/config/security.properties
+++ b/framework/security/config/security.properties
@@ -240,7 +240,7 @@ deniedWebShellTokens=java.,beans,freemarker,<script,javascript,<body,body ,<form
chmod,mkdir,fopen,fclose,new file,upload,getfilename,download,getoutputstring,readfile,iframe,object,embed,onload,build,\
python,perl ,/perl,ruby ,/ruby,process,function,class,InputStream,to_server,wget ,static,assign,webappPath,\
ifconfig,route,crontab,netstat,uname ,hostname,iptables,whoami,"cmd",*cmd|,+cmd|,=cmd|,localhost,thread,require,gzdeflate,\
- execute,println,calc
+ execute,println,calc,touch,calculate
#-- Max line length for uploaded files, by default 10000
maxLineLength=
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
index 235019f7d4..7c110155dd 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
@@ -135,9 +135,13 @@ public class ControlFilter implements Filter {
// Reject wrong URLs
try {
- String url = new URI(((HttpServletRequest) request).getRequestURL().toString()).normalize().toString();
+ String url = new URI(((HttpServletRequest) request).getRequestURL().toString())
+ .normalize().toString()
+ .replaceAll(";", "")
+ .replaceAll("(?i)%2e", "");
if (!((HttpServletRequest) request).getRequestURL().toString().equals(url)) {
- throw new RuntimeException();
+ Debug.logError("For security reason this URL is not accepted", module);
+ throw new RuntimeException("For security reason this URL is not accepted");
}
} catch (URISyntaxException e) {
throw new RuntimeException(e);
(ofbiz-framework) 01/03: Fixed: Error in PayGradeForms.xml Line: 65 (OFBIZ-13062)
Posted by jl...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch release18.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit e72a4a946116f0303f61d5b060bcb7ce281634b5
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Wed May 15 09:55:55 2024 +0200
Fixed: Error in PayGradeForms.xml Line: 65 (OFBIZ-13062)
Forgot to backport that
---
applications/humanres/widget/forms/PayGradeForms.xml | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/applications/humanres/widget/forms/PayGradeForms.xml b/applications/humanres/widget/forms/PayGradeForms.xml
index 1352322b23..efc280fc19 100644
--- a/applications/humanres/widget/forms/PayGradeForms.xml
+++ b/applications/humanres/widget/forms/PayGradeForms.xml
@@ -18,7 +18,7 @@
under the License.
-->
-<forms xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+<forms xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://ofbiz.apache.org/Widget-Form" xsi:schemaLocation="http://ofbiz.apache.org/Widget-Form http://ofbiz.apache.org/dtds/widget-form.xsd">
<form name="FindPayGrades" type="single" target="FindPayGrades" title=""
header-row-style="header-row" default-table-style="basic-table">
@@ -62,7 +62,6 @@
<form name="ListSalarySteps" type="multi" target="updateSalaryStep?salaryStepSeqId=${salaryStepSeqId}&payGradeId=${payGradeId}" paginate-target="findSalarySteps"
odd-row-style="alternate-row" header-row-style="header-row-2" default-table-style="basic-table hover-bar" separate-columns="true">
<actions>
- <entity-one entity-name="SalaryStep" auto-field-map="true"/>
<entity-condition entity-name="SalaryStep"> <condition-expr field-name="payGradeId" operator="equals" from-field="payGradeId"/><order-by field-name="salaryStepSeqId"/></entity-condition>
</actions>
<auto-fields-service service-name="updateSalaryStep"/>
(ofbiz-framework) 03/03: Fixed: The non ASCII language in UiLabels.xml are not correctly handled during plugin creation (OFBIZ-13095)
Posted by jl...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch release18.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit cb8c65124bca100b109f3cd1f7008a32239f3255
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Sun May 19 10:40:58 2024 +0200
Fixed: The non ASCII language in UiLabels.xml are not correctly handled during plugin creation (OFBIZ-13095)
You get this error:
2024-05-19 09:52:41,314 |jsse-nio-8443-exec-3 |UtilProperties |W| XML file for
locale could not be loaded.
org.xml.sax.SAXParseException: Invalid byte 3 of 3-byte UTF-8 sequence.
When removing ZH labels it works. We should keep only English languages or
amend the createPlugin Gradle task. In this commit I remove all non English
labels and put a comment as documentation about that for developers
in framework/resources/templates/UiLabels.xml
---
framework/resources/templates/UiLabels.xml | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)
diff --git a/framework/resources/templates/UiLabels.xml b/framework/resources/templates/UiLabels.xml
index b34d2142c7..c6b869a2e0 100644
--- a/framework/resources/templates/UiLabels.xml
+++ b/framework/resources/templates/UiLabels.xml
@@ -18,25 +18,19 @@ specific language governing permissions and limitations
under the License.
-->
+<!-- Keep only English language here because of OFBIZ-13095 -->
+
<resource xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://ofbiz.apache.org/dtds/ofbiz-properties.xsd">
<property key="@component-resource-name@Application">
<value xml:lang="en">@component-resource-name@ Application</value>
- <value xml:lang="zh">@component-resource-name@应用程序</value>
- <value xml:lang="zh-TW">@component-resource-name@應用程式</value>
</property>
<property key="@component-resource-name@CompanyName">
<value xml:lang="en">OFBiz: @component-resource-name@</value>
- <value xml:lang="zh-TW">OFBiz: @component-resource-name@</value>
</property>
<property key="@component-resource-name@CompanySubtitle">
<value xml:lang="en">Part of the Apache OFBiz Family of Open Source Software</value>
- <value xml:lang="it">Un modulo della famiglia di software open source Apache OFBiz</value>
- <value xml:lang="zh">开源软件OFBiz的组成部分</value>
- <value xml:lang="zh-TW">開源軟體OFBiz的組成部分</value>
</property>
<property key="@component-resource-name@ViewPermissionError">
<value xml:lang="en">You are not allowed to view this page.</value>
- <value xml:lang="zh">不允许你浏览这个页面。</value>
- <value xml:lang="zh-TW">不允許您檢視這個頁面.</value>
</property>
</resource>